Palo Alto Networks XDR-Analyst Exam Syllabus
Start Free XDR-Analyst Exam Practice After Reviewing the Topics
Before starting your XDR-Analyst exam preparation, it is recommended to review the complete Palo Alto Networks XDR Analyst exam syllabus and carefully go through the exam objectives listed below. Once you understand the exam structure and objectives, you should practice using our free XDR-Analyst questions. We also provide premium XDR-Analyst practice test, fully updated according to the latest exam objectives, to help you accurately assess your preparedness for the actual exam.
Palo Alto Networks
Vendor
XDR-Analyst
Exam Code
91
Total Questions
4
Total Exam Domains
Palo Alto Networks XDR-Analyst Exam Objectives
| Section 1: Alerting and Detection Processes | |
|
Weight: 23% |
1.1 Identify and explain different types of alerts and alert sources
1.2 Explain the alert prioritization handling process 1.2.1 Incident scoring 1.2.2 Alert starring 1.2.3 Featured fields 1.2.4 Custom prioritization configuration 1.3 Explain the incident creation process 1.4 Explain the concepts of alert grouping and data stitching |
| Section 2: Incident Handling and Response | |
|
Weight: 34% |
2.1 Review and investigate alert evidence
2.1.1 Forensics 2.1.2 Identity Threat Detection and Response (ITDR) 2.1.3 Causality chain 2.1.4 Timeline 2.2 Identify and analyze security events and incidents 2.3 Respond to incidents 2.3.1 Available response actions 2.3.2 Remediation suggestions 2.3.3 Automated responses 2.4 Identify and explain exclusions and exceptions |
| Section 3: Data Analysis | |
|
Weight: 28% |
3.1 Use XQL to query datasets
3.2 Identify and explain components of XQL data structure 3.2.1 Syntax and schema 3.2.2 Data Sources 3.3 Identify and explain data query options 3.3.1 Pre-defined query builder template 3.3.2 Query Library 3.3.3 Schedule Query 3.4 Use lookup tables 3.5 Identify, hunt, and investigate leads and indicators of compromise (IOCs) 3.6 Demonstrate understanding of Cortex XDR dashboards and reports 3.7 Identify and explain the data retention options in Cortex XDR 3.8 Explain the use of Host Insights information |
| Section 4: Endpoint Security Management | |
|
Weight: 15% |
4.1 Demonstrate understanding of endpoint prevention and extension profiles and policies
4.2 Identify and validate the impact of agent operational states 4.3 Identify and validate the impact of agent version and content update |
| Info | |